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NASA’s Ares I-X vehicle launched on a suborbital test flight from the Eastern Range in 
Florida on October 28, 2009. NASA generated a Range Safety (RS) product data package to meet 
the RS trajectory data requirements defined in the Air Force Space Command Manual 
(AFSPCMAN) 91-710. Some products included were a nominal ascent trajectory, ascent flight 
envelopes, and malfunction turn data. These products are used by the Air Force’s 45th Space 
Wing (45 SW) to ensure public safety and to make flight termination decisions on launch day. Due 
to the criticality of the RS data, an independent validation and verification (IV&V) effort was 
undertaken to accompany the data generation analyses to ensure utmost data quality and correct 
adherence to requirements. As a result of the IV&V efforts, the RS product package was delivered 
with confidence that two independent organizations using separate simulation software generated 
data to meet the range requirements and yielded similar results. This document captures the Ares 
I-X RS product IV&V analysis, including the methodology used to verify inputs, simulation, and 
output data for certain RS products. Additionally a discussion of lessons learned is presented to 
capture advantages and disadvantages to the IV&V processes used. 
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IV&V 

= Independent Validation and Verification 

JSC 

= Johnson Space Center 

LaRC 

= Langley Research Center 

LCRSP 

= Launch Constellation Range Safety Panel 

MAVERIC 

= Marshall Aerospace Vehicle Representation In C 

MFCO 

= Mission Flight Control Officer 

MSFC 

= Marshall Space Flight Center 

MT 

= Malfunction Turn 

PFPA 

= Preliminary Flight Plan Approval 

POST2 

= Program to Optimize Simulated Trajectories II 

QA 

= Quality Assurance 

RS 

= Range Safety 

TWG 

= Trajectory Working Group 

SSP 

= Space Shuttle Program 


I. Introduction 


A t Cape Canaveral, Air Force Range Safety Mission Flight Control Officers (MFCOs) monitor each space 
vehicle’s real-time ascent trajectory from an Eastern Range launch site with Range Safety (RS) displays. The 
Air Force’s 45th Space Wing (45SW) generates the displays, which provide information required by the MFCO to 
protect the critical geographic areas and population centers that are defined prior to launch. The displays are also 
used to make flight termination decisions in the event of an errant vehicle. Some of the input data required by the 
range to provide range safety support are mission specific RS products described in the Air Force Space Command 
Manual (AFSPCMAN) 91-710 requirements document. These data requirements must be met by the range user in 
order to obtain flight plan approval for a launch from a range-operated launch pad. Due to the critical safety aspect 
involved with protecting the public, it is imperative that the RS products be correct and delivered on-time. 
Consequences of incorrect data could include a launch delay, risk to people/facilities on the ground, or unintended 
flight termination. 

Timing is an important factor with RS products. It is important to provide the trajectory data based on the most 
recent and accurate input data to define the flight conditions for the launch. The RS products must be delivered on 
schedule in order to allow the 45 SW time to generate their mission-specific displays and range support data. 
Therefore, there is a window in which to generate and finalize the RS products. If the 45 SW finds an error in the 
product during their process, the potential exists for a launch delay. During a worst case scenario, a latent error in 
the RS product package could have impacts that could be devastating to mission success and public safety. In order 
to meet these stringent requirements an Independent Verification & Validation (IV&V) was performed to ensure that 
the RS products correctly satisfied range requirements (i.e. validation), and contained accurate data (i.e. 
verification). 

While IV&V tasks are performed for certain critical aspects of the Space Shuttle program, the Ares I-X IV&V 
analysis was customized for the Ares I-X RS project. The goal: to ensure that each layer of RS product design was 
correct, starting from the baseline nominal trajectory simulation up through the product results. The IV&V effort 
was implemented in parallel to the data generation process in order to catch any issues as soon as possible. This 
paper describes the IV&V efforts undertaken for the following RS products: nominal ascent trajectory, ascent flight 
envelopes, and malfunction turn data. The Ares I-X RS product analysis, strengthened by the rigor of the IV&V 
effort, produced vehicle trajectory data that was on-time and error free, contributing to the successful launch of Ares 
I-X. 


II. Ares I-X Independent Validation and Verification Project 


A. Scope of Work 

To support the 91-710 requirements, several NASA and contractor teams worked together. Table 1 lists the 
prime generation and verification teams for the Ares I-X RS products. In addition to the direct product support 
teams, the Launch Constellation Range Safety Panel (LCRSP) and its Range Safety Trajectory Working Group 
(TWG) provided direction and review for the RS products. The 45SW was involved throughout the generation and 
IV&V process ensuring the RS product package successfully met all requirements. 
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The nominal trajectory is the undispersed, 
no-fail trajectory predicted to be 
representative of day-of-launch conditions. 

The ascent flight envelopes define the 
trajectory positional downrange and uprange 
boundaries defined by predicted 
environmental and systems dispersions. The 
malfunction turn analysis describes the off-nominal trajectories that may result from a single system failure. 


Product 

Prime 

IV&V 

Nominal Ascent Trajectory 

LaRC 

JSC, MSFC 

Ascent Flight Envelope Data 

LaRC 

MSFC 

Malfunction Turn Data 

LaRC 

JSC 


Table 1 Ares I-X Roles and Responsibilities 


B. Simulation Comparison Overview 

Each center worked with an Ares I-X derived version of a particular 6 degree-of-freedom (6DOF) simulation. 
These will be referred to by the common name of the respective simulation throughout this paper: LaRC used 
Program to Optimize Simulated Trajectories II (POST2), JSC used Advanced NASA Technology Architecture for 
Exploration Studies (ANTARES) simulation and MSFC used Marshall Aerospace Vehicle Representation In C 
(MAVERIC). 

Prior to the start of the RS product design, simulation verification was completed to ensure that their Ares-I-X 
models were implemented properly, that the methodology and implementation of the MT failure modes was done 
consistently, and that they produced the same predictions for the vehicle response to the MT failures considered. 
Once the simulations were on equal ground, the nominal trajectory design 1V&V was performed by both the MSFC 
and JSC teams to validate the LaRC nominal trajectory and improve the simulation fidelity. 

As updates were provided from the project, referenced data was incorporated into the simulation. Table data, 
such as aerodynamic and mass properties, were transferred into their corresponding coordinate formats and frames. 
Verification of the implementation was verified through running a pre-defined QA test matrix, as well as comparing 
new models with prior released models. Any discrepancies were noted and further investigated to determine if there 
were issues with a specific simulation or if it occurred across all simulations. As each model was updated, its 
original source and date were noted and tracked in a common configuration management spreadsheet. 

Both quantitative and qualitative comparisons were performed. Qualitatively, plots of all predefined parameters 
were done for each simulation run while quantitatively each parameter was numerically differenced. Any differences 
were either justified through hard reasoning or re-evaluated to determine its root cause. 

C. Nominal Trajectory Comparison 

The nominal ascent trajectory is the baseline for all RS data products delivered to the Range. If there was any 
error in the trajectory simulation, it would manifest itself throughout the RS products. Several vehicle specific 
models were required to complete the nominal simulation: 

• Flight software 

• Guidance and control flight software 

• Aerodynamics 

• Mass properties 

• Propulsion: ATK Solid Rocket Booster, reaction control thrusters 

While the IV&V activity could not verify that each of these models accurately reflected the vehicle 
configuration, the independent nature of implementing these models would uncover if models were implemented 
incorrectly. This assumes that because the same model is being implemented in two different simulations, the 
implementations would vary and therefore a common error manifesting in different implementations of the same 
model is highly unlikely. 

Tests of individual models were not compared between organizations, only integrated simulation results. There 
is risk associated with this approach of making it more difficult to determine the source of a particular discrepancy. 
For example, an error in the gimbal location of the main engine will result in a mismatch between commanded 
deflections and moments induced on the vehicle. The control system will respond to the corresponding rates with 
gimbal corrections. The analyst troubleshooting this problem may have difficulty determining if the control system 
implementation is causing or responding to the issue. 

Exact matches between simulations were not required in order to verify accuracy. It is understood that different 
methodologies produce different results, but both can be representative of the truth. Quantifying the magnitude of an 
acceptable deviation between simulations, especially for the first flight of a new vehicle, can be challenging. 
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Some tolerances were derived from simulation comparison tolerances used by the Space Shuttle Day-of-Launch 
I-Load Update (DOLILU) process, however these tolerances have been honed over years of operations where 
differences can be eliminated by repeated analysis. In addition, some of the tolerances are particular to the type of 
trajectory flown by the Space Shuttle. 

Additional tolerances were derived from an interpretation of how the range safety products are processed. The 
impact point of the vehicle is a key parameter of the trajectory data used by the 45SW. Thus tolerances were derived 
based on the effects of differences in certain state parameters on the corresponding differences in downrange and 
cross range impact position. In effect, the partial derivatives of position and velocity components with respect to 
cross range and down range were computed by perturbing individual state parameters. These partials were formally 
computed at LaRC and confirmed with a similar analysis conducted by the JSC IV&V team. 

D. Off-Nominal Trajectory Comparison 

While the nominal ascent trajectory is the basis for all other trajectories, it is only a single, relatively benign 
representation of the flight conditions the vehicle may experience. A diverse set of runs was developed to simulate 
off nominal environmental and vehicle failure conditions across a variety of flight regimes. This section briefly 
describes these runs and how these runs were selected. 

As described, the nominal trajectory included nominal mean monthly winds. Five other simulations varying only 
the wind used were also performed: Zero wind and four directional worst case scenario winds. The zero wind 
trajectory was used to isolate wind related effects and eliminate wind as a cause of any control related issues. The 
worst case winds aren’t real winds at all. They are worst case from a RS perspective in that they assumed the 
maximum reasonable wind at all altitude in the four cardinal directions: north, east, south, and west. A strong wind 
in single direction maximizes the effect of the wind on the impact footprint. 

Malfunctions which lead to off-nominal trajectories, and often vehicle breakup due to aerodynamic or structural 
loads, are a key 91-710 requirement. Due to the number of different failures and time window in which these 
failures can occur, thousands of different trajectories must be simulated. Rather than attempt to QA each of these 
which would be time prohibitive, several representative cases were chosen. Each failure mode was modeled. Failure 
times were distributed across the two minutes of powered flight to capture failures at low speed, high dynamic 
pressure, and supersonic/low dynamic pressure flight regimes. 

Quantitative and qualitative comparisons were also performed on these trajectories. Because of the rapidly 
changing dynamics involved in the malfunction scenarios, it was expected that the tolerances used for the nominal 
comparison would not be large enough. Additional evaluation criteria were added including time of breakup. 

E. Envelope Generation 

The ascent envelope trajectories delivered to the 45SW provide information on whether or not a vehicle is 
performing within the limits of normality, based on known vehicle system and environmental dispersions. A vehicle 
flying within the envelope trajectories is considered normal, while a vehicle flying outside an envelope alerts the 
range to a possible vehicle system malfunction. It is important to provide accurate envelope information, so as to 
avoid flight termination of a vehicle that is otherwise performing normally within known uncertainties. 

The Ares I-X ascent flight envelope methodology was jointly developed by the stakeholders within the RSTWG. 
The 45 SW provided oversight to ensure that the methodology used satisfied their requirements for flight plan 
approval. The JSC team, with experience generating Space Shuttle Range Safety products for the 45 SW, provided 
inputs on the methodology as well as lessons learned from the SSP. This included comparisons of the individual 
Ares I-X dispersion parameters against those used in the SSP. As part of the ascent envelope data delivery process, 
the ascent flight envelope trajectories were required to be in a range specific format. The JSC team formatted the 
trajectories created by LaRC using existing Space Shuttle tools. For the IV&V portion, the LaRC team created 
separate tools to generate the formatted trajectories and ensured that the output matched. 

The Ares I-X ascent flight envelope data verification was accomplished through both qualitative and quantitative 
assessments of the results, reviewed and approved by the TWG. The LaRC team used the POST2 simulation to 
generate the dispersed trajectories, while MSFC used the MAVERIC simulation for verification. Both centers 
conducted sensitivity analyses comparing the effects of each dispersion parameter on the nominal trajectory to 
ensure that they were being modeled correctly, and that the dispersions providing the largest deviations from 
nominal were similar between simulations. Each center’s trajectories were plotted in their respective envelope 
planes and compared qualitatively to ensure that the distribution of trajectories about the nominal were similar. 
Statistical bounds were produced from the distributions for each simulation and were compared. The differences 
between the two simulations were quantitatively compared using the simulation match criteria previously 
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established for the simulation comparison. The differences between the two simulations fell within the established 
criteria, thus meeting the verification requirements. 

F. Malfunction Turn 

The MT analysis determines the launch vehicle’s maximum turning capability, or deviations from the nominal 
trajectory, caused by a single failure. The following data products are created from this analysis: 

1. a set of malfunction turn trajectories described by a 41 parameter set, 

2. a composite table describing the maximum turn angle of the velocity vectors produced from the set of 

malfunction turn trajectories at one second intervals after the failure through the first 12 seconds of the 
malfunction turn, and 

3. a list of all trajectories with the corresponding time of vehicle breakup and the probability of occurrence. 

These products provide the 45 SW an understanding of how the vehicle may behave due to a failure and 

information to build destruct criteria. 

The IV&V team supported the analysis methodology development including the identification of vehicle failure 
scenarios and development of the malfunction turn trajectory run matrix, in an effort to validate that the analysis 
satisfied the requirements. Additionally the team ran the malfunction turn trajectories using an independent 6DOF 
simulation and created an independent composite turn table and table of vehicle breakup times to compare to the 
data produced by LaRC and verify the MT data product. 

G. Results and Lesson Learned 

During the IV&V effort that was conducted in parallel with the RS data generation effort, errors and issues were 
uncovered early and resolved in both simulation modeling and product generation. By the time the data analyses 
were complete, the results of the IV&V effort yielded data consistent in content and scope to the actual deliverable 
data, thereby providing confidence that the deliverable data was of high quality. 

There is no flight data with which to compare the majority of the RS product data, however, the Best Estimated 
Trajectory (BET) for the I-X mission, which was built to be representative of the actual trajectory on launch day, 
flew close to the preflight nominal trajectory and within the flight envelopes. 

III. Conclusion 

While the Ares I-X RS product IV&V effort added cost to the RS data generation process, it proved to be a 
valuable asset to the RS product analysis. The IV&V work was thorough and the measures taken during the analysis 
were customized to ensure each step of the RS data generation process was correct. IV&V allowed the data 
generators to work through issues early in the process such that a high quality, complete product was generated and 
delivered to the 45 SW, thereby contributing to the successful launch of Ares I-X. The 45 SW was able to use the RS 
product data to build their mission range safety support data and displays and ensure public safety. 
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